gfx/cairo/14-image-surface-oob-read.patch

   1 diff --git a/gfx/cairo/cairo/src/cairo-quartz-surface.c b/gfx/cairo/cairo/src/cairo-quartz-surface.c
   2 --- a/gfx/cairo/cairo/src/cairo-quartz-surface.c
   3 +++ b/gfx/cairo/cairo/src/cairo-quartz-surface.c
   4 @@ -873,8 +873,12 @@ static cairo_status_t
   5         return _cairo_error (CAIRO_STATUS_NO_MEMORY);
   6      }
   7
   8 +    // The last row of data may have less than stride bytes so make sure we
   9 +    // only copy the minimum amount required from that row.
  10      memcpy (image_data, image_surface->data,
  11 -           image_surface->height * image_surface->stride);
  12 +           (image_surface->height - 1) * image_surface->stride +
  13 +           cairo_format_stride_for_width (image_surface->format,
  14 +                                          image_surface->width));
  15      *image_out = CairoQuartzCreateCGImage (image_surface->format,
  16                                            image_surface->width,
  17                                            image_surface->height,